Critical PHP Vulnerabilities – what AWS users need to do now
Henrik Lewander Article 
On October 21, 2026, PHP released emergency security fixes for two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The flaws can allow attackers to take over vulnerable web servers without authentication. And attacks are already happening, with millions of exploitation attempts reported by Cloudflare's CEO, according to Reuters.
If you're running WordPress, WooCommerce, Magento, Drupal, Laravel or anything else built on PHP, your environment may be affected. This isn't limited to AWS. The vulnerabilities also affect PHP environments running on Azure, Google Cloud and on-premises servers.
To help companies identify and protect vulnerable systems, Cloud Family's CTO, Henrik Lewander, has outlined four concrete actions to take right now, including specific recommendations for AWS users.
What should you do about PHP2Shell?
1. Find all PHP workloads
Identify every PHP environment, including containers, AWS Elastic Beanstalk, Amazon Lightsail and old test environments. Don't forget the systems that are still running but rarely used.
2. Update PHP to a patched version
Install one of the following fixed versions:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Alternatively, use your distribution's security-patched packages. PHP 8.1 and older versions no longer receive official security releases. Upgrade or isolate these environments.
3. Apply temporary protection if you can't patch today
Put protection in front of vulnerable servers. AWS WAF and Cloudflare offer protections for PHP2Shell. These can help reduce exposure while you're working on updates. However, WAF protections are not a complete fix. Patching remains essential.
4. Check for signs of compromise
Review activity from October 17 onwards. Look for unexpected files, unusual server activity and other signs that someone may have gained unauthorized access.
Running PHP on AWS? Check Amazon Inspector.
Amazon Inspector can help identify vulnerable resources in your AWS environment. But make sure it's enabled in every region you use and that it's actually scanning all relevant resources.
Zero findings don't necessarily mean zero vulnerabilities. If scanning isn't properly configured, vulnerable workloads may go undetected.